Manuals / Kerio Tech / Computer Equipment / Network Router

Kerio Tech Firewall6 manual 326, Filial oﬃce VPN server conﬁguration

Models: Firewall6

1 398

Download 398 pages 11.9 Kb

Page 326

Chapter 21 Kerio VPN

Figure 21.28 Filial oﬃce — VPN server conﬁguration

For a detailed description on the VPN server conﬁguration, refer to chapter 21.1.

5.Create an active endpoint of the VPN tunnel which will connect to the headquar- ters server (newyork.company.com). Use the ﬁngerprint of the VPN server of the headquarters as a speciﬁcation of the ﬁngerprint of the remote SSL certiﬁcate.

At this point, connection should be established (i.e. the tunnel should be created). If connected successfully, the Connected status will be reported in the Adapter info column for both ends of the tunnel. If the connection cannot be established, we recommend you to check the conﬁguration of the traﬃc rules and test availability of the remote server — in our example, the ping newyork.company.com command can be used at the branch oﬃce server.

Note: If a collision of VPN network and the remote network is detected upon creation of the VPN tunnel, select an appropriate free subnet and specify its parameters at the VPN server (see Step 4).

For detailed information on how to create VPN tunnels, see chapter 21.3.

6.Add the new VPN tunnel into the Local Traﬃc rule. It is also possible to remove the Dial-Ininterface and the VPN clients group from this rule (VPN clients are not allowed to connect to the branch oﬃce).

326

Image 326

Kerio Tech Firewall6 manual 326, Filial oﬃce VPN server conﬁguration

Contents

Administrator’s Guide Kerio TechnologiesPage Contents 113 Remote Administration and Update Checks 209 Kerio Clientless SSL-VPN 355 393 Quick Checklist Page Kerio WinRoute Firewall Basic FeaturesIntroduction Additional Features Kerio WinRoute FirewallEmail alerts Antivirus controlTransparent support for Active Directory User quotasCollision of low-level drivers Conﬂicting softwareClientless SSL-VPN Port collisionAntivirus applications Steps to be taken before the installation InstallationInstallation System requirementsInstallation and Basic Conﬁguration Guide Custom installation selecting optional components Protection of the installed product Conﬂicting Applications and System Services WinRoute Engine Monitor WinRoute ComponentsWinRoute Firewall Engine WinRoute Engine Monitor Kerio Administration ConsoleWinRoute Engine Monitor Upgrade and Uninstallation Typically the path C\Program Files\Kerio\WinRoute Firewall Upgrade and UninstallationUninstallation Setting of administration username and password Upgrade from WinRoute ProUpdate Checker Conﬁguration WizardRemote IP address Remote AccessEnable remote access Initial conﬁguration Allowing remote administration WinRoute Administration Administration WindowFile WinRoute AdministrationAdministration Window Main menu Help menuDetection of WinRoute Firewall Engine connection drop-out Administration WindowStatus bar View Settings Column customization in InterfacesView Settings License types optional components Product Registration and LicensingLicense types and number of users License types and number of users Deciding on a number of users licensesCopyright License informationProduct HomepageProduct expiration date License IDSubscription expiration date Number of usersRegistration of the product in the Administration Console Registration of the trial versionRegistration of the product in the Administration Console Trial version registration security codeTrial version registration other information Registration of the purchased product Trial version registration Trial IDProduct Registration and Licensing Registration of the product in the Administration Console 10 Product registration user information Update of registration information 12 Product registration summarySubscription / Update Expiration Product registration at the websiteSubscription / Update Expiration Bubble alertsUser counter 15 The notice that the subscription has already expiredLicense counter User counterStart WinRoute License release Interface Settings for Interfaces and Network ServicesNetwork interfaces IP Address and MaskAdd Dial or Hang Up /Enebale, DisableAdapter info ModifyDial-In RefreshSpecial interfaces VPN serverBind this interface Interface type selectionInterface name Use login data from the RAS entryUse the following login data RAS EntryConnection Dial-up demand dialHangup if idle AdvancedConnection Failover Edit Interface parametersConnection Failover Connection Failover SetupEnable automatic connection failover Current connectionConﬁguration of primary and secondary Internet connection Dial-up Use Primary connectionSecondary connection DNS Forwarder DNS Forwarder conﬁgurationDNS forwarding Enable DNS forwardingDNS Forwarder Clear cache Enable cache for faster response of repeated queriesEnable DNS forwarding Use custom forwarding10 Speciﬁc settings of DNS forwarding Simple DNS resolution 11 DNS forwarding a new ruleBefore forwarding a query Combine the name ... with DNS domainDhcp server Deﬁnition of Scopes and Reservations Dhcp serverDhcp Server Conﬁguration Wins server Lease timeDNS server DomainDescription 15 Dhcp server IP scopes deﬁnitionExclusions First address, Last addressSubnet mask Parameters Lease Reservations 00bca5f21e50Bc-a5-f2-1e-50 Leases20 Dhcp server list of leased and reserved IP addresses Dhcp server advanced options Windows RASProxy server Declined optionsProxy Server Conﬁguration Enable non-transparent proxy serverProxy server Enable connection to any TCP port 22 Http proxy server settingsForward to parent proxy server Http//192.168.1.13128/pac/proxy.pacHttp cache Enable cache on transparent proxyEnable cache on proxy server Http protocol TTLHttp cache Cache sizeCache Options Memory cache sizeMax Http object size URL Speciﬁc Settings URLCache status and administration TTL26 Http cache administration dialog Traﬃc Policy Network Rules WizardSelection of Internet connection type Network Rules WizardInformation Network adapter or dial-up selection Network Policy Wizard selection of a connected adapterInternet access limitations Allow access to all servicesAllow access to the following services only Enabling Kerio VPN traﬃcService is running on ServiceNAT Generating the rulesRules Created by the Wizard Icmp traﬃcLocal Traﬃc Firewall Traﬃc Name How traﬃc rules workDeﬁnition of Custom Traﬃc Rules Source, Destination 12 Traﬃc rule name, color and rule descriptionIP range e.g Deﬁnition of Custom Traﬃc Rules Service 100Action 101Log 102Translation 103104 20 Traﬃc rule destination address translation105 Valid onProtocol inspector Source Basic Traﬃc Rule TypesIP Translation NAT DestinationPort mapping TranslationPlacing the rule 107108 109 Limiting Internet AccessMultihoming 110 Exclusions 111112 Bandwidth Limiter How the bandwidth limiter works and how to use itSpeed limits for big data volumes transmissions Speed limits for users with their quota exceededBandwidth Limiter Setting limit valuesBandwidth Limiter conﬁguration 114115 ServicesAdvanced Options IP Addresses and Time Interval 116Bandwidth Limiter selection of network services 117Detection of connections with large data volume transferred 118119 Detection of connections with large data volume transferredExamples 120 121 User AuthenticationFirewall User Authentication 122 User AuthenticationUser authentication advanced options Enable non-transparent proxy server authentication Firewall User AuthenticationRedirection to the authentication Automatic authentication NtlmAutomatically logout users when they are inactive 124Web Interface Enable Kerio SSL-VPN serverEnable Web Interface Http Web Interface Parameters ConﬁgurationWeb Interface Enable secured Web Interface HttpsAllow access only from these IP addresses WinRoute server nameConﬁguration of ports of the Web Interface 127128 SSL Certiﬁcate for the Web InterfaceGenerate or Import Certiﬁcate 129 SSL certiﬁcate of WinRoute’s Web interfaceUsers logged Login/logoutWeb Interface Language Preferences 130131 Login/logoutDrdolittle@usoffice.company.com 132 User password authenticationLog out 133 Status information and user statisticsStatus information and user statistics User preferences 134135 Save settingsUser preferences 10 Editing user password 136137 Http protocolFTP protocol 138 Conditions for Http and FTP ﬁlteringURL Rules URL Rules 139URL Rules Deﬁnition 140141 If user accessing the URL isURL matches criteria Allow access to the Web site 142Valid if Mime type is Valid at time intervalValid for IP address group Denial optionsDeny Web pages containing WWW content scanning optionsScan content for viruses according to scanning rules 144Http Inspection Advanced Options 145Allow Script Html tags Global rules for Web elementsAllow Html ActiveX objects 146Allow applet Html tags Content Rating System ISS OrangeWeb FilterAllow Html JavaScript pop-up windows Allow cross-domain referrerISS OrangeWeb Filter conﬁguration 148Server Enable ISS OrangeWeb FilterCategorize each page regardless of Http rules ISS OrangeWeb Filter Deployment150 ISS OrangeWeb Filter ruleWeb content ﬁltering by word occurrence 151Deﬁnition of rules ﬁltering by word occurrence 152Word groups 153Deﬁnition of forbidden words 154Group WeightFTP Policy KeywordFTP server is If user accessing the FTP server isFTP Rules Deﬁnition 15615 FTP Rule basic parameters Content 158159 160 Antivirus controlConditions and limitations of antivirus scan Conditions and limitations of antivirus scan 161Integrated McAfee How to choose and setup antivirusesAntivirus control 162Update now Check for update every ... hoursLast update check performed ... ago Current virus database is164 Antivirus settingsExternal antivirus 165 An example of a traﬃc rule for outgoing Smtp traﬃc checkHttp and FTP scanning Http and FTP scanning 167168 Http and FTP scanning rulesCondition Mime type 169Email scanning 170Email scanning 171172 173 IP Address GroupsCreating and Editing IP Address Groups Name Time IntervalsDeﬁnitions TypeWeekly Time range typesAbsolute DailyValid at days Time Interval TypeFrom, To 176177 ServicesServices 178 ProtocolProtocol inspector 179 Source Port and Destination PortProtocol Inspectors URL Groups 180URL Groups 181Deﬁnitions Group 182Import of user accounts from Active Directory User Accounts and GroupsInternal user database 183184 Viewing and deﬁnitions of user accountsUser Accounts and Groups Local user accounts Edit User Local user accountsAccounts mapped from the Active Directory domain 186Basic information Local user accountsCreating a local user account Full NameEmail Address AuthenticationAccount is disabled Domain template189 NT domain / KerberosGroups Access rights 190Full access to administration No access to administrationRead only access to administration User can override WWW content rules192 Data transmission quotaTransfer quota 193 Content rulesQuota exceed action User’s IP addresses 194Editing User Account 195196 Active DirectoryNT domain Automatic import of user accounts from Active Directory 197Manual import of user accounts 198Domain mapping requirements Active Directory domains mappingActive Directory domains mapping 199Active Directory mapping Domain AccessSingle domain mapping 200201 13 Active Directory domain mapping202 NT authentication supportMultiple domains mapping 203 16 Conversion of user accounts204 User groupsUser groups Deﬁnitions Name and description of the group User groupsCreating a new local user group 205Group members Group access rightsRead only access 206207 Users can override WWW content rulesUsers can connect using VPN 208 Users are allowed to use P2P networksUsers are allowed to view statistics How to allow remote administration from the Internet Remote Administration and Update ChecksSetting Remote Administration 209210 Update CheckingRemote Administration and Update Checks Check also for beta versions Update CheckingCheck for new versions Check now212 P2P Eliminator Conﬁguration Advanced security features15.1 P2P Eliminator 213Advanced security features 214215 15.1 P2P EliminatorParameters for detection of P2P networks Special Security Settings 216Connections Count Limit Special Security SettingsAnti-Spooﬁng 217Enable pass-through only for hosts VPN using IPSec ProtocolEnable IPSec preferencesIPSec client in local network VPN using IPSec ProtocolWinRoute’s IPSec conﬁguration 219220 Traﬃc rule for one IPSec client in the local networkIPSec server in local network 221Other settings Routing tableStatic routes Routing tableRoute Types 223Gateway Deﬁnitions of Dynamic and Static RulesNetwork, Network Mask MetricRemoving routes from the Routing Table Demand DialDemand Dial How demand dial works226 Technical Peculiarities and Limitations 227Setting Rules for Demand Dial 228Dial of local DNS names 229Universal Plug-and-Play UPnP Enable UPnPPort mapping timeout Conﬁguration of the UPnP supportLog packets Relay Smtp serverRelay Smtp server Log connectionsTest Smtp requires authenticationSpecify sender email address in From header 232233 234 Status InformationActive hosts and connected users Hostname Login timeLogin duration UserActive Hosts dialog options Detailed information on a selected host and user Traﬃc information 238239 Activity DescriptionConnections Source, Destination 240Histogram 241Show connections related to the selected process 242Show connections related to the selected process 243244 Options of the Connections DialogKill connection Background Color Color SettingsFont Color 245246 Alerts SettingsAlerts 247 AlertsAlert Alert Templates 248249 \Program Files\Kerio\WinRoute Firewall\templates by defaultAlerts overview in Administration Console 250 13 Details of a selected event251 Basic statisticsInterface statistics Interface Statistics menu Reset interface statisticsBasic statistics 252Graphical view of interface load Interface statisticsRemove interface statistics 253User Statistics data volumes and quotas 254255 User Statistics data volumes and quotasUser Statistics dialog options View host Reset user statisticsRemove user statistics 256257 Kerio StaR statistics and reportingMonitoring and storage of statistic data Requirements of the statistics Settings for statistics and quotaKerio StaR statistics and reporting 258Advanced settings for statistics Settings for statistics and quotaEnable/disable gathering of statistic data 259Statistics and quota restrictions 260Connection to StaR and viewing statistics Accessing the statistics from the WinRoute hostRemote access to the statistics Statistics and quota accounting periodsStaR page in the web interface 262Accounting period 263264 Custom accounting period265 Overall ViewOverall View 266 Top Requested Web CategoriesTop 5 users Used Protocol 267268 269 User statisticsUser statistics Users by Traﬃc 13 The Users by Traﬃc tableTop Visited Websites Top Visited WebsitesTop Requested Web Categories 272273 16 Top visited websites sorted by categories274 Filename.log Log settingsLogs 275File Logging 276277 Log settingsSyslog Logging Logs Context Menu Highlighting Logs Context MenuFind Select fontClear log Logs EncodingLog debug Log highlightingLog highlighting settings Debug log advanced settings 282Alert Log Alert Log284 20.4 Conﬁg LogLogs 285 Connection LogConnection Log 286 Debug LogDial Log Page 15/Mar/2004 155912 Line Connection disconnected 288289 Error LogError Log 290 ’McAfee update’ rule nameFilter Log 291 Http logHttp log 1058444114.733 0 192.168.64.64 TCPMISS/304 292293 Security LogSecurity Log Authentication service Client IP address reason 29417/Dec/2004 121133 Engine Startup Sslvpn LogSslvpn Log 17/Dec/2004 122243 Engine ShutdownWeb Log 24/Apr/2003 102951 192.168.44.128 jamesWeb Log 297 Kerio VPN 298VPN Server Conﬁguration 299General Enable VPN serverKerio VPN IP address assignmentSSL certiﬁcate 301302 AdvancedListen on port Custom Routes 303304 21.2 Conﬁguration of VPN clientsBasic conﬁguration of traﬃc rules for VPN clients Name of the tunnel Setting up VPN serversDeﬁnition of a tunnel to a remote server 305Conﬁguration 306Conﬁguration of a remote end of the tunnel 307308 DNS SettingsRouting settings Connection establishment 309Traﬃc Policy Settings for VPN 310Routing conﬁguration options Exchange of routing informationExchange of routing information 311312 Update of routing tablesRoutes provided automatically 313 Example of Kerio VPN conﬁguration company with a ﬁlial oﬃceSpeciﬁcation Common method 314315 Headquarters conﬁguration 31614 Headquarter creating default traﬃc rules for Kerio VPN 317318 16 Headquarter DNS forwarder conﬁguration319 320 19 Headquarters VPN server conﬁgurationLAN 321Conﬁguration of a ﬁlial oﬃce 32224 Filial oﬃce default traﬃc rules for Kerio VPN 323324 25 Filial oﬃce DNS forwarder conﬁguration325 326 28 Filial oﬃce VPN server conﬁguration327 29 Filial oﬃce deﬁnition of VPN tunnel for the headquarters328 Example of a more complex Kerio VPN conﬁgurationVPN test Common method 329330 331 33 Headquarter creating default traﬃc rules for Kerio VPN 332333 35 Headquarter DNS forwarder conﬁgurationKerio VPN 335 38 Headquarters VPN server conﬁguration336 39 Headquarter deﬁnition of VPN tunnel for the London ﬁlial337 338 339 43 Headquarter ﬁnal traﬃc rulesConﬁguration of the London ﬁlial 34046 The London ﬁlial oﬃce default traﬃc rules for Kerio VPN 34148 The London ﬁlial oﬃce DNS forwarding settings 342343 344 345 346 54 The London ﬁlial oﬃce ﬁnal traﬃc rulesConﬁguration of the Paris ﬁlial 347348 57 The Paris ﬁlial oﬃce DNS forwarder conﬁguration349 59 The Paris ﬁlial oﬃce VPN server conﬁguration350 351 352 353 64 The Paris ﬁlial oﬃce ﬁnal traﬃc rules354 SSL-VPN conﬁguration Kerio Clientless SSL-VPN22.1 Conﬁguration of WinRoute’s SSL-VPN 355356 Allowing access from the InternetKerio Clientless SSL-VPN Https//server Usage of the SSL-VPN interfaceUsage of the SSL-VPN interface Https//server12345358 Sidneywashington@usoffice.company.comHandling ﬁles and folders Bookmarks \\server\folder\subfolderAntivirus control 359360 TroubleshootingDetection of incorrect conﬁguration of the default gateway 23.2 Conﬁguration Backup and Transfer Cache.CFS SslcertLicense Dnscache.cfg363 Handling conﬁguration ﬁles Conﬁguration backup recoveryStar List name=Interfaces 365 Automatic user authentication using NtlmGeneral conditions WinRoute Conﬁguration 366Web browsers Automatic user authentication using NtlmNtlm authentication process Microsoft Internet Explorer368 Firefox/Netscape/Mozilla/SeaMonkeyFirefox/Netscape/Mozilla/SeaMonkey conﬁguration 369 Partial Retirement of Protocol InspectorPartial Retirement of Protocol Inspector 370 How to enable certain users to access the InternetUser accounts and groups in traﬃc rules Enabling automatic authentication 371372 FTP on WinRoute’s proxy serverExample of a client conﬁguration web browser 373 Example of a client conﬁguration Total CommanderFTP on WinRoute’s proxy server 12 Setting proxy server for FTP in Total Commander 374Network Conﬁguration Network Load BalancingBasic Information and System Requirements 375Network Load Balancing 376377 24.3 Conﬁguration of the servers in the clusterNLB conﬁguration for Server1 378 Server 1 cluster parametersNLB conﬁguration for Server2 379Description Technical supportEssential Information 380Informational File Error Log FilesTested in Beta version License type and license numberCzech Republic ContactsUnited Kingdom Legal Presumption OpenSSL Used open-source librariesLibiconv 384Zlib PrototypeCopyright 2005 Sam Stephenson 385ActiveX Default gatewayGlossary of terms Cluster387 FirewallGreylisting Kerberos Glossary of terms IP addressIPSec 388Packet Network adapterP2P network PortRouting table Glossary of termsProxy server ScriptSpooﬁng 391TCP/IP 392Index 393Index 394Ntlm 395VPN 396133 397